tasks.py

   1 from invoke import task
   2 from invoke.exceptions import Failure, UnexpectedExit
   3
   4 import os
   5 import sys
   6 import time
   7
   8 auth_backend_ip_addr = os.getenv('AUTH_BACKEND_IP_ADDR', '127.0.0.1')
   9
  10 clang_version = os.getenv('CLANG_VERSION', '13')
  11 rust_version = 'rust-1.72.0-x86_64-unknown-linux-gnu'
  12
  13 all_build_deps = [
  14     'ccache',
  15     'libboost-all-dev',
  16     'libluajit-5.1-dev',
  17     'libsodium-dev',
  18     'libssl-dev',
  19     'libsystemd-dev',
  20     'libtool',
  21     'make',
  22     'pkg-config',
  23     'python3-venv',
  24     'systemd',
  25 ]
  26 git_build_deps = [
  27     'autoconf',
  28     'automake',
  29     'bison',
  30     'bzip2',
  31     'curl',
  32     'flex',
  33     'git',
  34     'ragel'
  35 ]
  36 auth_build_deps = [    # FIXME: perhaps we should be stealing these from the debian (Ubuntu) control file
  37     'default-libmysqlclient-dev',
  38     'libcdb-dev',
  39     'libcurl4-openssl-dev',
  40     'libgeoip-dev',
  41     'libkrb5-dev',
  42     'libldap2-dev',
  43     'liblmdb-dev',
  44     'libmaxminddb-dev',
  45     'libp11-kit-dev',
  46     'libpq-dev',
  47     'libsqlite3-dev',
  48     'libyaml-cpp-dev',
  49     'libzmq3-dev',
  50     'ruby-bundler',
  51     'ruby-dev',
  52     'sqlite3',
  53     'unixodbc-dev',
  54     'cmake',
  55 ]
  56 rec_build_deps = [
  57     'libcap-dev',
  58     'libfstrm-dev',
  59     'libsnmp-dev',
  60 ]
  61 rec_bulk_deps = [
  62     'curl',
  63     'libboost-all-dev',
  64     'libcap2',
  65     'libfstrm0',
  66     'libluajit-5.1-2',
  67     '"libsnmp[1-9]+"',
  68     'libsodium23',
  69     'libssl1.1',
  70     'libsystemd0',
  71     'moreutils',
  72     'pdns-tools',
  73     'unzip',
  74 ]
  75 dnsdist_build_deps = [
  76     'libcap-dev',
  77     'libcdb-dev',
  78     'libedit-dev',
  79     'libfstrm-dev',
  80     'libgnutls28-dev',
  81     'libh2o-evloop-dev',
  82     'liblmdb-dev',
  83     'libnghttp2-dev',
  84     'libre2-dev',
  85     'libsnmp-dev',
  86 ]
  87 auth_test_deps = [   # FIXME: we should be generating some of these from shlibdeps in build
  88     'authbind',
  89     'bc',
  90     'bind9utils',
  91     'curl',
  92     'default-jre-headless',
  93     'dnsutils',
  94     'faketime',
  95     'gawk',
  96     'krb5-user',
  97     'ldnsutils',
  98     '"libboost-serialization1.7[1-9]+"',
  99     'libcdb1',
 100     'libcurl4',
 101     'libgeoip1',
 102     'libkrb5-3',
 103     'libldap-2.4-2',
 104     'liblmdb0',
 105     'libluajit-5.1-2',
 106     'libmaxminddb0',
 107     'libnet-dns-perl',
 108     'libp11-kit0',
 109     'libpq5',
 110     'libsodium23',
 111     'libsqlite3-dev',
 112     'libssl1.1',
 113     'libsystemd0',
 114     'libyaml-cpp0.6',
 115     'libzmq3-dev',
 116     'lmdb-utils',
 117     'prometheus',
 118     'ruby-bundler',
 119     'ruby-dev',
 120     'socat',
 121     'softhsm2',
 122     'unbound-host',
 123     'unixodbc',
 124     'wget',
 125 ]
 126 doc_deps = [
 127     'autoconf',
 128     'automake',
 129     'bison',
 130     'curl',
 131     'flex',
 132     'g++',
 133     'git',
 134     'latexmk',
 135     'libboost-all-dev',
 136     'libedit-dev',
 137     'libluajit-5.1-dev',
 138     'libssl-dev',
 139     'make',
 140     'pkg-config',
 141     'python3-venv',
 142     'ragel',
 143     'rsync',
 144 ]
 145 doc_deps_pdf = [
 146     'texlive-binaries',
 147     'texlive-formats-extra',
 148     'texlive-latex-extra',
 149 ]
 150
 151 @task
 152 def apt_fresh(c):
 153     c.sudo('sed -i \'s/azure\.//\' /etc/apt/sources.list')
 154     c.sudo('apt-get update')
 155     c.sudo('apt-get -y --allow-downgrades dist-upgrade')
 156
 157 @task
 158 def install_clang(c):
 159     """
 160     install clang and llvm
 161     """
 162     c.sudo(f'apt-get -y --no-install-recommends install clang-{clang_version} llvm-{clang_version}')
 163
 164 @task
 165 def install_clang_tidy_tools(c):
 166     c.sudo(f'apt-get -y --no-install-recommends install clang-tidy-{clang_version} clang-tools-{clang_version} bear python3-yaml')
 167
 168 @task
 169 def install_clang_runtime(c):
 170     # this gives us the symbolizer, for symbols in asan/ubsan traces
 171     c.sudo(f'apt-get -y --no-install-recommends install clang-{clang_version}')
 172
 173 @task
 174 def ci_install_rust(c, repo):
 175     c.sudo(f'{repo}/builder-support/helpers/install_rust.sh {rust_version}')
 176
 177 def install_libdecaf(c, product):
 178     c.run('git clone https://git.code.sf.net/p/ed448goldilocks/code /tmp/libdecaf')
 179     with c.cd('/tmp/libdecaf'):
 180         c.run('git checkout 41f349')
 181         c.run(f'CC=clang-{clang_version} CXX=clang-{clang_version} '
 182               'cmake -B build '
 183               '-DCMAKE_INSTALL_PREFIX=/usr/local '
 184               '-DCMAKE_INSTALL_LIBDIR=lib '
 185               '-DENABLE_STATIC=OFF '
 186               '-DENABLE_TESTS=OFF '
 187               '-DCMAKE_C_FLAGS="-Wno-sizeof-array-div -Wno-array-parameter" .')
 188         c.run('make -C build')
 189         c.run('sudo make -C build install')
 190     c.sudo(f'mkdir -p /opt/{product}/libdecaf')
 191     c.sudo(f'cp /usr/local/lib/libdecaf.so* /opt/{product}/libdecaf/.')
 192
 193 @task
 194 def install_doc_deps(c):
 195     c.sudo('apt-get install -y ' + ' '.join(doc_deps))
 196
 197 @task
 198 def install_doc_deps_pdf(c):
 199     c.sudo('apt-get install -y ' + ' '.join(doc_deps_pdf))
 200
 201 @task
 202 def install_auth_build_deps(c):
 203     c.sudo('apt-get install -y --no-install-recommends ' + ' '.join(all_build_deps + git_build_deps + auth_build_deps))
 204     install_libdecaf(c, 'pdns-auth')
 205
 206 def setup_authbind(c):
 207     c.sudo('touch /etc/authbind/byport/53')
 208     c.sudo('chmod 755 /etc/authbind/byport/53')
 209
 210 auth_backend_test_deps = dict(
 211     gsqlite3=['sqlite3'],
 212     gmysql=['default-libmysqlclient-dev'],
 213     gpgsql=['libpq-dev'],
 214     lmdb=[],
 215     remote=[],
 216     bind=[],
 217     geoip=[],
 218     lua2=[],
 219     tinydns=[],
 220     authpy=[],
 221     godbc_sqlite3=['libsqliteodbc'],
 222     godbc_mssql=['freetds-bin','tdsodbc'],
 223     ldap=[],
 224     geoip_mmdb=[]
 225 )
 226
 227 @task(help={'backend': 'Backend to install test deps for, e.g. gsqlite3; can be repeated'}, iterable=['backend'], optional=['backend'])
 228 def install_auth_test_deps(c, backend): # FIXME: rename this, we do way more than apt-get
 229     extra=[]
 230     for b in backend:
 231         extra.extend(auth_backend_test_deps[b])
 232     c.sudo('DEBIAN_FRONTEND=noninteractive apt-get -y install ' + ' '.join(extra+auth_test_deps))
 233
 234     c.run('chmod +x /opt/pdns-auth/bin/* /opt/pdns-auth/sbin/*')
 235     # c.run('''if [ ! -e $HOME/bin/jdnssec-verifyzone ]; then
 236     #               wget https://github.com/dblacka/jdnssec-tools/releases/download/0.14/jdnssec-tools-0.14.tar.gz
 237     #               tar xfz jdnssec-tools-0.14.tar.gz -C $HOME
 238     #               rm jdnssec-tools-0.14.tar.gz
 239     #          fi
 240     #          echo 'export PATH=$HOME/jdnssec-tools-0.14/bin:$PATH' >> $BASH_ENV''')  # FIXME: why did this fail with no error?
 241     c.run('touch regression-tests/tests/verify-dnssec-zone/allow-missing regression-tests.nobackend/rectify-axfr/allow-missing') # FIXME: can this go?
 242     # FIXME we may want to start a background recursor here to make ALIAS tests more robust
 243     setup_authbind(c)
 244
 245     # Copy libdecaf out
 246     c.sudo('mkdir -p /usr/local/lib')
 247     c.sudo('cp /opt/pdns-auth/libdecaf/libdecaf.so* /usr/local/lib/.')
 248
 249 @task
 250 def install_rec_bulk_deps(c): # FIXME: rename this, we do way more than apt-get
 251     c.sudo('apt-get --no-install-recommends -y install ' + ' '.join(rec_bulk_deps))
 252     c.run('chmod +x /opt/pdns-recursor/bin/* /opt/pdns-recursor/sbin/*')
 253
 254 @task
 255 def install_rec_test_deps(c): # FIXME: rename this, we do way more than apt-get
 256     c.sudo('apt-get --no-install-recommends install -y ' + ' '.join(rec_bulk_deps) + ' \
 257               pdns-server pdns-backend-bind daemontools \
 258               jq libfaketime lua-posix lua-socket bc authbind \
 259               python3-venv python3-dev default-libmysqlclient-dev libpq-dev \
 260               protobuf-compiler snmpd prometheus')
 261
 262     c.run('chmod +x /opt/pdns-recursor/bin/* /opt/pdns-recursor/sbin/*')
 263
 264     setup_authbind(c)
 265
 266     c.run('sed "s/agentxperms 0700 0755 recursor/agentxperms 0777 0755/g" regression-tests.recursor-dnssec/snmpd.conf | sudo tee /etc/snmp/snmpd.conf')
 267     c.sudo('/etc/init.d/snmpd restart')
 268     time.sleep(5)
 269     c.sudo('chmod 755 /var/agentx')
 270
 271 @task
 272 def install_dnsdist_test_deps(c): # FIXME: rename this, we do way more than apt-get
 273     c.sudo('apt-get install -y \
 274               libluajit-5.1-2 \
 275               libboost-all-dev \
 276               libcap2 \
 277               libcdb1 \
 278               libcurl4-openssl-dev \
 279               libfstrm0 \
 280               libgnutls30 \
 281               libh2o-evloop0.13 \
 282               liblmdb0 \
 283               libnghttp2-14 \
 284               "libre2-[1-9]+" \
 285               libssl-dev \
 286               libsystemd0 \
 287               libsodium23 \
 288               lua-socket \
 289               patch \
 290               protobuf-compiler \
 291               python3-venv snmpd prometheus')
 292     c.run('sed "s/agentxperms 0700 0755 dnsdist/agentxperms 0777 0755/g" regression-tests.dnsdist/snmpd.conf | sudo tee /etc/snmp/snmpd.conf')
 293     c.sudo('/etc/init.d/snmpd restart')
 294     time.sleep(5)
 295     c.sudo('chmod 755 /var/agentx')
 296
 297 @task
 298 def install_rec_build_deps(c):
 299     c.sudo('apt-get install -y --no-install-recommends ' +  ' '.join(all_build_deps + git_build_deps + rec_build_deps))
 300
 301 @task
 302 def install_dnsdist_build_deps(c):
 303     c.sudo('apt-get install -y --no-install-recommends ' +  ' '.join(all_build_deps + git_build_deps + dnsdist_build_deps))
 304
 305 @task
 306 def ci_autoconf(c):
 307     c.run('autoreconf -vfi')
 308
 309 @task
 310 def ci_docs_build(c):
 311     c.run('make -f Makefile.sphinx -C docs html')
 312
 313 @task
 314 def ci_docs_build_pdf(c):
 315     c.run('make -f Makefile.sphinx -C docs latexpdf')
 316
 317 @task
 318 def ci_docs_upload_master(c, docs_host, pdf, username, product, directory=""):
 319     rsync_cmd = " ".join([
 320         "rsync",
 321         "--checksum",
 322         "--recursive",
 323         "--verbose",
 324         "--no-p",
 325         "--chmod=g=rwX",
 326         "--exclude '*~'",
 327     ])
 328     c.run(f"{rsync_cmd} --delete ./docs/_build/{product}-html-docs/ {username}@{docs_host}:{directory}")
 329     c.run(f"{rsync_cmd} ./docs/_build/{product}-html-docs.tar.bz2 {username}@{docs_host}:{directory}/html-docs.tar.bz2")
 330     c.run(f"{rsync_cmd} ./docs/_build/latex/{pdf} {username}@{docs_host}:{directory}")
 331
 332 @task
 333 def ci_docs_add_ssh(c, ssh_key, host_key):
 334     c.run('mkdir -m 700 -p ~/.ssh')
 335     c.run(f'echo "{ssh_key}" > ~/.ssh/id_ed25519')
 336     c.run('chmod 600 ~/.ssh/id_ed25519')
 337     c.run(f'echo "{host_key}" > ~/.ssh/known_hosts')
 338
 339
 340 def get_sanitizers():
 341     sanitizers = os.getenv('SANITIZERS')
 342     if sanitizers != '':
 343         sanitizers = sanitizers.split('+')
 344         sanitizers = ['--enable-' + sanitizer for sanitizer in sanitizers]
 345         sanitizers = ' '.join(sanitizers)
 346     return sanitizers
 347
 348
 349 def get_cflags():
 350     return " ".join([
 351         "-O1",
 352         "-Werror=vla",
 353         "-Werror=shadow",
 354         "-Wformat=2",
 355         "-Werror=format-security",
 356         "-Werror=string-plus-int",
 357     ])
 358
 359
 360 def get_cxxflags():
 361     return " ".join([
 362         get_cflags(),
 363         "-Wp,-D_GLIBCXX_ASSERTIONS",
 364     ])
 365
 366
 367 def get_base_configure_cmd():
 368     return " ".join([
 369         f'CFLAGS="{get_cflags()}"',
 370         f'CXXFLAGS="{get_cxxflags()}"',
 371         './configure',
 372         f"CC='clang-{clang_version}'",
 373         f"CXX='clang++-{clang_version}'",
 374         "--enable-option-checking=fatal",
 375         "--enable-systemd",
 376         "--with-libsodium",
 377         "--enable-fortify-source=auto",
 378         "--enable-auto-var-init=pattern",
 379     ])
 380
 381
 382 @task
 383 def ci_auth_configure(c):
 384     sanitizers = get_sanitizers()
 385
 386     unittests = os.getenv('UNIT_TESTS')
 387     if unittests == 'yes':
 388         unittests = '--enable-unit-tests --enable-backend-unit-tests'
 389     else:
 390         unittests = ''
 391
 392     fuzz_targets = os.getenv('FUZZING_TARGETS')
 393     fuzz_targets = '--enable-fuzz-targets' if fuzz_targets == 'yes' else ''
 394
 395     modules = " ".join([
 396         "bind",
 397         "geoip",
 398         "gmysql",
 399         "godbc",
 400         "gpgsql",
 401         "gsqlite3",
 402         "ldap",
 403         "lmdb",
 404         "lua2",
 405         "pipe",
 406         "remote",
 407         "tinydns",
 408     ])
 409     configure_cmd = " ".join([
 410         get_base_configure_cmd(),
 411         "LDFLAGS='-L/usr/local/lib -Wl,-rpath,/usr/local/lib'",
 412         f"--with-modules='{modules}'",
 413         "--enable-tools",
 414         "--enable-experimental-pkcs11",
 415         "--enable-experimental-gss-tsig",
 416         "--enable-remotebackend-zeromq",
 417         "--with-lmdb=/usr",
 418         "--with-libdecaf",
 419         "--prefix=/opt/pdns-auth",
 420         "--enable-ixfrdist",
 421         sanitizers,
 422         unittests,
 423         fuzz_targets,
 424     ])
 425     res = c.run(configure_cmd, warn=True)
 426     if res.exited != 0:
 427         c.run('cat config.log')
 428         raise UnexpectedExit(res)
 429
 430
 431 @task
 432 def ci_rec_configure(c):
 433     sanitizers = get_sanitizers()
 434
 435     unittests = os.getenv('UNIT_TESTS')
 436     unittests = '--enable-unit-tests' if unittests == 'yes' else ''
 437
 438     configure_cmd = " ".join([
 439         get_base_configure_cmd(),
 440         "--enable-nod",
 441         "--prefix=/opt/pdns-recursor",
 442         "--with-lua=luajit",
 443         "--with-libcap",
 444         "--with-net-snmp",
 445         "--enable-dns-over-tls",
 446         sanitizers,
 447         unittests,
 448     ])
 449     res = c.run(configure_cmd, warn=True)
 450     if res.exited != 0:
 451         c.run('cat config.log')
 452         raise UnexpectedExit(res)
 453
 454
 455 @task
 456 def ci_dnsdist_configure(c, features):
 457     additional_flags = ''
 458     if features == 'full':
 459       features_set = '--enable-dnstap \
 460                       --enable-dnscrypt \
 461                       --enable-dns-over-tls \
 462                       --enable-dns-over-https \
 463                       --enable-systemd \
 464                       --prefix=/opt/dnsdist \
 465                       --with-gnutls \
 466                       --with-h2o \
 467                       --with-libsodium \
 468                       --with-lua=luajit \
 469                       --with-libcap \
 470                       --with-net-snmp \
 471                       --with-nghttp2 \
 472                       --with-re2 '
 473     else:
 474       features_set = '--disable-dnstap \
 475                       --disable-dnscrypt \
 476                       --disable-ipcipher \
 477                       --disable-systemd \
 478                       --without-cdb \
 479                       --without-ebpf \
 480                       --without-gnutls \
 481                       --without-h2o \
 482                       --without-libedit \
 483                       --without-libsodium \
 484                       --without-lmdb \
 485                       --without-net-snmp \
 486                       --without-nghttp2 \
 487                       --without-re2 '
 488       additional_flags = '-DDISABLE_COMPLETION \
 489                           -DDISABLE_DELAY_PIPE \
 490                           -DDISABLE_DYNBLOCKS \
 491                           -DDISABLE_PROMETHEUS \
 492                           -DDISABLE_PROTOBUF \
 493                           -DDISABLE_BUILTIN_HTML \
 494                           -DDISABLE_CARBON \
 495                           -DDISABLE_SECPOLL \
 496                           -DDISABLE_DEPRECATED_DYNBLOCK \
 497                           -DDISABLE_LUA_WEB_HANDLERS \
 498                           -DDISABLE_NON_FFI_DQ_BINDINGS \
 499                           -DDISABLE_POLICIES_BINDINGS \
 500                           -DDISABLE_PACKETCACHE_BINDINGS \
 501                           -DDISABLE_DOWNSTREAM_BINDINGS \
 502                           -DDISABLE_COMBO_ADDR_BINDINGS \
 503                           -DDISABLE_CLIENT_STATE_BINDINGS \
 504                           -DDISABLE_QPS_LIMITER_BINDINGS \
 505                           -DDISABLE_SUFFIX_MATCH_BINDINGS \
 506                           -DDISABLE_NETMASK_BINDINGS \
 507                           -DDISABLE_DNSNAME_BINDINGS \
 508                           -DDISABLE_DNSHEADER_BINDINGS \
 509                           -DDISABLE_RECVMMSG \
 510                           -DDISABLE_WEB_CACHE_MANAGEMENT \
 511                           -DDISABLE_WEB_CONFIG \
 512                           -DDISABLE_RULES_ALTERING_QUERIES \
 513                           -DDISABLE_ECS_ACTIONS \
 514                           -DDISABLE_TOP_N_BINDINGS \
 515                           -DDISABLE_OCSP_STAPLING \
 516                           -DDISABLE_HASHED_CREDENTIALS \
 517                           -DDISABLE_FALSE_SHARING_PADDING \
 518                           -DDISABLE_NPN'
 519     unittests = ' --enable-unit-tests' if os.getenv('UNIT_TESTS') == 'yes' else ''
 520     fuzztargets = '--enable-fuzz-targets' if os.getenv('FUZZING_TARGETS') == 'yes' else ''
 521     sanitizers = ' '.join('--enable-'+x for x in os.getenv('SANITIZERS').split('+')) if os.getenv('SANITIZERS') != '' else ''
 522     cflags = '-O1 -Werror=vla -Werror=shadow -Wformat=2 -Werror=format-security -Werror=string-plus-int'
 523     cxxflags = cflags + ' -Wp,-D_GLIBCXX_ASSERTIONS ' + additional_flags
 524     res = c.run(f'''CFLAGS="%s" \
 525                    CXXFLAGS="%s" \
 526                    AR=llvm-ar-{clang_version} \
 527                    RANLIB=llvm-ranlib-{clang_version} \
 528                    ./configure \
 529                      CC='clang-{clang_version}' \
 530                      CXX='clang++-{clang_version}' \
 531                      --enable-option-checking=fatal \
 532                      --enable-fortify-source=auto \
 533                      --enable-auto-var-init=pattern \
 534                      --enable-lto=thin \
 535                      --prefix=/opt/dnsdist %s %s %s %s''' % (cflags, cxxflags, features_set, sanitizers, unittests, fuzztargets), warn=True)
 536     if res.exited != 0:
 537         c.run('cat config.log')
 538         raise UnexpectedExit(res)
 539
 540 @task
 541 def ci_auth_make(c):
 542     c.run('make -j8 -k V=1')
 543
 544 @task
 545 def ci_auth_make_bear(c):
 546     # Needed for clang-tidy -line-filter vs project structure shenanigans
 547     with c.cd('pdns'):
 548         c.run('bear --append -- make -j8 -k V=1 -C ..')
 549
 550 @task
 551 def ci_rec_make(c):
 552     c.run('make -j8 -k V=1')
 553
 554 @task
 555 def ci_rec_make_bear(c):
 556     # Assumed to be running under ./pdns/recursordist/
 557     c.run('bear --append -- make -j8 -k V=1')
 558
 559 @task
 560 def ci_dnsdist_make(c):
 561     c.run('make -j4 -k V=1')
 562
 563 @task
 564 def ci_dnsdist_make_bear(c):
 565     # Assumed to be running under ./pdns/dnsdistdist/
 566     c.run('bear --append -- make -j4 -k V=1')
 567
 568 @task
 569 def ci_auth_install_remotebackend_test_deps(c):
 570     with c.cd('modules/remotebackend'):
 571       # c.run('bundle config set path vendor/bundle')
 572       c.run('sudo ruby -S bundle install')
 573     c.sudo('apt-get install -y socat')
 574
 575 @task
 576 def ci_auth_run_unit_tests(c):
 577     res = c.run('make check', warn=True)
 578     if res.exited != 0:
 579       c.run('cat pdns/test-suite.log', warn=True)
 580       c.run('cat modules/remotebackend/test-suite.log', warn=True)
 581       raise UnexpectedExit(res)
 582
 583 @task
 584 def ci_rec_run_unit_tests(c):
 585     res = c.run('make check', warn=True)
 586     if res.exited != 0:
 587       c.run('cat test-suite.log')
 588       raise UnexpectedExit(res)
 589
 590 @task
 591 def ci_dnsdist_run_unit_tests(c):
 592     res = c.run('make check', warn=True)
 593     if res.exited != 0:
 594       c.run('cat test-suite.log')
 595       raise UnexpectedExit(res)
 596
 597 @task
 598 def ci_make_distdir(c):
 599     res = c.run('make distdir')
 600
 601 @task
 602 def ci_make_install(c):
 603     res = c.run('make install') # FIXME: this builds auth docs - again
 604
 605 @task
 606 def add_auth_repo(c, dist_name, dist_release_name, pdns_repo_version):
 607     c.sudo('apt-get install -y curl gnupg2')
 608     if pdns_repo_version == 'master':
 609         c.sudo('curl -s -o /etc/apt/trusted.gpg.d/pdns-repo.asc https://repo.powerdns.com/CBC8B383-pub.asc')
 610     else:
 611         c.sudo('curl -s -o /etc/apt/trusted.gpg.d/pdns-repo.asc https://repo.powerdns.com/FD380FBB-pub.asc')
 612     c.run(f"echo 'deb [arch=amd64] http://repo.powerdns.com/{dist_name} {dist_release_name}-auth-{pdns_repo_version} main' | sudo tee /etc/apt/sources.list.d/pdns.list")
 613     c.run("echo 'Package: pdns-*' | sudo tee /etc/apt/preferences.d/pdns")
 614     c.run("echo 'Pin: origin repo.powerdns.com' | sudo tee -a /etc/apt/preferences.d/pdns")
 615     c.run("echo 'Pin-Priority: 600' | sudo tee -a /etc/apt/preferences.d/pdns")
 616     c.sudo('apt-get update')
 617
 618 @task
 619 def test_api(c, product, backend=''):
 620     if product == 'recursor':
 621         with c.cd('regression-tests.api'):
 622             c.run(f'PDNSRECURSOR=/opt/pdns-recursor/sbin/pdns_recursor ./runtests recursor {backend}')
 623     elif product == 'auth':
 624         with c.cd('regression-tests.api'):
 625             c.run(f'PDNSSERVER=/opt/pdns-auth/sbin/pdns_server PDNSUTIL=/opt/pdns-auth/bin/pdnsutil SDIG=/opt/pdns-auth/bin/sdig MYSQL_HOST={auth_backend_ip_addr} PGHOST={auth_backend_ip_addr} PGPORT=5432 ./runtests authoritative {backend}')
 626     else:
 627         raise Failure('unknown product')
 628
 629 backend_regress_tests = dict(
 630     bind = [
 631         'bind-both',
 632         'bind-dnssec-both',
 633         'bind-dnssec-nsec3-both',
 634         'bind-dnssec-nsec3-optout-both',
 635         'bind-dnssec-nsec3-narrow',
 636         # FIXME  'bind-dnssec-pkcs11'
 637     ],
 638     geoip = [
 639         'geoip',
 640         'geoip-nsec3-narrow'
 641     ],
 642     lua2 = ['lua2', 'lua2-dnssec'],
 643     tinydns = ['tinydns'],
 644     remote = [
 645         'remotebackend-pipe',
 646         'remotebackend-unix',
 647         'remotebackend-http',
 648         'remotebackend-zeromq',
 649         'remotebackend-pipe-dnssec',
 650         'remotebackend-unix-dnssec',
 651         'remotebackend-http-dnssec',
 652         'remotebackend-zeromq-dnssec'
 653     ],
 654     lmdb = [
 655         'lmdb-nodnssec-both',
 656         'lmdb-both',
 657         'lmdb-nsec3-both',
 658         'lmdb-nsec3-optout-both',
 659         'lmdb-nsec3-narrow'
 660     ],
 661     gmysql = [
 662         'gmysql',
 663         'gmysql-nodnssec-both',
 664         'gmysql-nsec3-both',
 665         'gmysql-nsec3-optout-both',
 666         'gmysql-nsec3-narrow',
 667         'gmysql_sp-both'
 668     ],
 669     gpgsql = [
 670         'gpgsql',
 671         'gpgsql-nodnssec-both',
 672         'gpgsql-nsec3-both',
 673         'gpgsql-nsec3-optout-both',
 674         'gpgsql-nsec3-narrow',
 675         'gpgsql_sp-both'
 676     ],
 677     gsqlite3 = [
 678         'gsqlite3',
 679         'gsqlite3-nodnssec-both',
 680         'gsqlite3-nsec3-both',
 681         'gsqlite3-nsec3-optout-both',
 682         'gsqlite3-nsec3-narrow'
 683     ],
 684     godbc_sqlite3 = ['godbc_sqlite3-nodnssec'],
 685     godbc_mssql = [
 686         'godbc_mssql',
 687         'godbc_mssql-nodnssec',
 688         'godbc_mssql-nsec3',
 689         'godbc_mssql-nsec3-optout',
 690         'godbc_mssql-nsec3-narrow'
 691     ],
 692     ldap = [
 693         'ldap-tree',
 694         'ldap-simple',
 695         'ldap-strict'
 696     ],
 697     geoip_mmdb = ['geoip'],
 698 )
 699
 700 godbc_mssql_credentials = {"username": "sa", "password": "SAsa12%%"}
 701
 702 godbc_config = f'''
 703 [pdns-mssql-docker]
 704 Driver=FreeTDS
 705 Trace=No
 706 Server={auth_backend_ip_addr}
 707 Port=1433
 708 Database=pdns
 709 TDS_Version=7.1
 710
 711 [pdns-mssql-docker-nodb]
 712 Driver=FreeTDS
 713 Trace=No
 714 Server={auth_backend_ip_addr}
 715 Port=1433
 716 TDS_Version=7.1
 717
 718 [pdns-sqlite3-1]
 719 Driver = SQLite3
 720 Database = pdns.sqlite3
 721
 722 [pdns-sqlite3-2]
 723 Driver = SQLite3
 724 Database = pdns.sqlite32
 725 '''
 726
 727 def setup_godbc_mssql(c):
 728     with open(os.path.expanduser("~/.odbc.ini"), "a") as f:
 729         f.write(godbc_config)
 730     c.sudo('sh -c \'echo "Threading=1" | cat /usr/share/tdsodbc/odbcinst.ini - | tee -a /etc/odbcinst.ini\'')
 731     c.sudo('sed -i "s/libtdsodbc.so/\/usr\/lib\/x86_64-linux-gnu\/odbc\/libtdsodbc.so/g" /etc/odbcinst.ini')
 732     c.run(f'echo "create database pdns" | isql -v pdns-mssql-docker-nodb {godbc_mssql_credentials["username"]} {godbc_mssql_credentials["password"]}')
 733     # FIXME: Skip 8bit-txt-unescaped test
 734     c.run('touch ${PWD}/regression-tests/tests/8bit-txt-unescaped/skip')
 735
 736 def setup_godbc_sqlite3(c):
 737     with open(os.path.expanduser("~/.odbc.ini"), "a") as f:
 738         f.write(godbc_config)
 739     c.sudo('sed -i "s/libsqlite3odbc.so/\/usr\/lib\/x86_64-linux-gnu\/odbc\/libsqlite3odbc.so/g" /etc/odbcinst.ini')
 740
 741 def setup_ldap_client(c):
 742     c.sudo('DEBIAN_FRONTEND=noninteractive apt-get install -y ldap-utils')
 743     c.sudo(f'sh -c \'echo "{auth_backend_ip_addr} ldapserver" | tee -a /etc/hosts\'')
 744
 745 @task
 746 def test_auth_backend(c, backend):
 747     pdns_auth_env_vars = f'PDNS=/opt/pdns-auth/sbin/pdns_server PDNS2=/opt/pdns-auth/sbin/pdns_server SDIG=/opt/pdns-auth/bin/sdig NOTIFY=/opt/pdns-auth/bin/pdns_notify NSEC3DIG=/opt/pdns-auth/bin/nsec3dig SAXFR=/opt/pdns-auth/bin/saxfr ZONE2SQL=/opt/pdns-auth/bin/zone2sql ZONE2LDAP=/opt/pdns-auth/bin/zone2ldap ZONE2JSON=/opt/pdns-auth/bin/zone2json PDNSUTIL=/opt/pdns-auth/bin/pdnsutil PDNSCONTROL=/opt/pdns-auth/bin/pdns_control PDNSSERVER=/opt/pdns-auth/sbin/pdns_server SDIG=/opt/pdns-auth/bin/sdig GMYSQLHOST={auth_backend_ip_addr} GMYSQL2HOST={auth_backend_ip_addr} MYSQL_HOST={auth_backend_ip_addr} PGHOST={auth_backend_ip_addr} PGPORT=5432'
 748
 749     if backend == 'remote':
 750         ci_auth_install_remotebackend_test_deps(c)
 751
 752     if backend == 'authpy':
 753         c.sudo(f'sh -c \'echo "{auth_backend_ip_addr} kerberos-server" | tee -a /etc/hosts\'')
 754         with c.cd('regression-tests.auth-py'):
 755             c.run(f'{pdns_auth_env_vars} WITHKERBEROS=YES ./runtests')
 756         return
 757
 758     if backend == 'godbc_sqlite3':
 759         setup_godbc_sqlite3(c)
 760         with c.cd('regression-tests'):
 761             for variant in backend_regress_tests[backend]:
 762                 c.run(f'{pdns_auth_env_vars} GODBC_SQLITE3_DSN=pdns-sqlite3-1 ./start-test-stop 5300 {variant}')
 763         return
 764
 765     if backend == 'godbc_mssql':
 766         setup_godbc_mssql(c)
 767         with c.cd('regression-tests'):
 768             for variant in backend_regress_tests[backend]:
 769                 c.run(f'{pdns_auth_env_vars} GODBC_MSSQL_PASSWORD={godbc_mssql_credentials["password"]} GODBC_MSSQL_USERNAME={godbc_mssql_credentials["username"]} GODBC_MSSQL_DSN=pdns-mssql-docker GODBC_MSSQL2_PASSWORD={godbc_mssql_credentials["password"]} GODBC_MSSQL2_USERNAME={godbc_mssql_credentials["username"]} GODBC_MSSQL2_DSN=pdns-mssql-docker ./start-test-stop 5300 {variant}')
 770         return
 771
 772     if backend == 'ldap':
 773         setup_ldap_client(c)
 774
 775     if backend == 'geoip_mmdb':
 776         with c.cd('regression-tests'):
 777             for variant in backend_regress_tests[backend]:
 778                 c.run(f'{pdns_auth_env_vars} geoipdatabase=../modules/geoipbackend/regression-tests/GeoLiteCity.mmdb ./start-test-stop 5300 {variant}')
 779         return
 780
 781     with c.cd('regression-tests'):
 782         if backend == 'lua2':
 783             c.run('touch trustedkeys')  # avoid silly error during cleanup
 784         for variant in backend_regress_tests[backend]:
 785             c.run(f'{pdns_auth_env_vars} ./start-test-stop 5300 {variant}')
 786
 787     if backend == 'gsqlite3':
 788         if os.getenv('SKIP_IPV6_TESTS'):
 789             pdns_auth_env_vars += ' context=noipv6'
 790         with c.cd('regression-tests.nobackend'):
 791             c.run(f'{pdns_auth_env_vars} ./runtests')
 792         c.run('/opt/pdns-auth/bin/pdnsutil test-algorithms')
 793         return
 794
 795 @task
 796 def test_ixfrdist(c):
 797     with c.cd('regression-tests.ixfrdist'):
 798         c.run('IXFRDISTBIN=/opt/pdns-auth/bin/ixfrdist ./runtests')
 799
 800 @task
 801 def test_dnsdist(c):
 802     c.run('chmod +x /opt/dnsdist/bin/*')
 803     c.run('ls -ald /var /var/agentx /var/agentx/master')
 804     c.run('ls -al /var/agentx/master')
 805     with c.cd('regression-tests.dnsdist'):
 806         c.run('DNSDISTBIN=/opt/dnsdist/bin/dnsdist ./runtests')
 807
 808 @task
 809 def test_regression_recursor(c):
 810     c.run('/opt/pdns-recursor/sbin/pdns_recursor --version')
 811     c.run('PDNSRECURSOR=/opt/pdns-recursor/sbin/pdns_recursor RECCONTROL=/opt/pdns-recursor/bin/rec_control ./build-scripts/test-recursor')
 812
 813 @task
 814 def test_bulk_recursor(c, threads, mthreads, shards):
 815     # We run an extremely small version of the bulk test, as GH does not seem to be able to handle the UDP load
 816     with c.cd('regression-tests'):
 817         c.run('curl -LO http://s3-us-west-1.amazonaws.com/umbrella-static/top-1m.csv.zip')
 818         c.run('unzip top-1m.csv.zip -d .')
 819         c.run('chmod +x /opt/pdns-recursor/bin/* /opt/pdns-recursor/sbin/*')
 820         c.run(f'DNSBULKTEST=/usr/bin/dnsbulktest RECURSOR=/opt/pdns-recursor/sbin/pdns_recursor RECCONTROL=/opt/pdns-recursor/bin/rec_control THRESHOLD=95 TRACE=no ./timestamp ./recursor-test 5300 100 {threads} {mthreads} {shards}')
 821
 822 @task
 823 def install_swagger_tools(c):
 824     c.run('npm install -g api-spec-converter')
 825
 826 @task
 827 def swagger_syntax_check(c):
 828     c.run('api-spec-converter docs/http-api/swagger/authoritative-api-swagger.yaml -f swagger_2 -t openapi_3 -s json -c')
 829
 830 @task
 831 def install_coverity_tools(c, project):
 832     token = os.getenv('COVERITY_TOKEN')
 833     c.run(f'curl -s https://scan.coverity.com/download/linux64 --data "token={token}&project={project}" | gunzip | sudo tar xvf /dev/stdin --strip-components=1 --no-same-owner -C /usr/local', hide=True)
 834
 835 @task
 836 def coverity_clang_configure(c):
 837     c.sudo(f'/usr/local/bin/cov-configure --template --comptype clangcc --compiler clang++-{clang_version}')
 838
 839 @task
 840 def coverity_make(c):
 841     c.run('/usr/local/bin/cov-build --dir cov-int make -j8 -k')
 842
 843 @task
 844 def coverity_tarball(c, tarball):
 845     c.run(f'tar caf {tarball} cov-int')
 846
 847 @task
 848 def coverity_upload(c, email, project, tarball):
 849     token = os.getenv('COVERITY_TOKEN')
 850     c.run(f'curl --form token={token} \
 851             --form email="{email}" \
 852             --form file=@{tarball} \
 853             --form version="$(./builder-support/gen-version)" \
 854             --form description="master build" \
 855             https://scan.coverity.com/builds?project={project}', hide=True)
 856
 857 # this is run always
 858 def setup():
 859     if '/usr/lib/ccache' not in os.environ['PATH']:
 860         os.environ['PATH']='/usr/lib/ccache:'+os.environ['PATH']
 861
 862 setup()